Splunk SDK for Python

2.1.1 · active · verified Sat Apr 11

The Splunk Software Development Kit for Python allows developers to programmatically interact with the Splunk platform's REST API. It provides a Pythonic interface for searching data, managing configurations, working with indexes and inputs, and building custom applications. The library is actively maintained with frequent minor releases and bug fixes.

Warnings

breaking Version 2.0.0 removed all Python 2 compatibility, including the `six.py` dependency and `__future__` imports. Applications developed for Python 2 using older SDK versions will break.
Fix: Migrate your code to Python 3 and ensure all dependencies are Python 3 compatible. Review the 2.0.0 release notes for specific changes.
breaking Splunk Enterprise 10.0 (and later) has deprecated and deactivated Search API v1.0 endpoints, urging migration to Search API v2.0. Applications relying on older SDK methods that implicitly use v1.0 may encounter breaking changes when connecting to newer Splunk instances.
Fix: Review Splunk's API documentation for Search API v2.0 and update your SDK usage accordingly to ensure compatibility with modern Splunk Enterprise versions.
deprecated The `wrap_socket` method in the `Context` class was deprecated and subsequently removed in version 2.1.0.
Fix: Remove any usage of `wrap_socket`. Implement custom HTTP handlers if specific socket wrapping functionality is required.
gotcha Connecting to Splunk using HTTPS with self-signed certificates might lead to SSL verification errors. While explicit support for self-signed certificates was added in 2.1.0, developers might still need to configure the `verify` parameter in `client.connect` (e.g., set to `False` for testing) or properly manage certificates. Setting `verify=False` is not recommended for production environments.
Fix: For production, ensure valid SSL certificates are used or configure certificate trust appropriately. For development/testing with self-signed certs, set `verify=False` in `client.connect` with caution.
gotcha The SDK's `.env` file for storing connection credentials is strictly for development convenience and should NOT be used for production credentials due to security risks.
Fix: For production deployments, use secure methods for credential management, such as environment variables, secrets management services, or Splunk's built-in authentication mechanisms (e.g., bearer tokens, session keys) directly in your application code.

Install

pip install splunk-sdk Install with pip

Imports

client
```
import splunklib.client as client
```
The `splunklib.client` module is the primary entry point for connecting to a Splunk instance and accessing its resources.

Quickstart

This quickstart demonstrates how to connect to a Splunk Enterprise instance using username and password authentication, and then lists the installed applications. It uses environment variables for credentials, which is a common practice for security.

import os
import splunklib.client as client

# Configure connection details using environment variables or replace directly
HOST = os.environ.get('SPLUNK_HOST', 'localhost')
PORT = int(os.environ.get('SPLUNK_PORT', 8089))
USERNAME = os.environ.get('SPLUNK_USERNAME', 'admin')
PASSWORD = os.environ.get('SPLUNK_PASSWORD', 'your_password') # Use a strong password or token in production

try:
    # Connect to Splunk
    service = client.connect(
        host=HOST,
        port=PORT,
        username=USERNAME,
        password=PASSWORD,
        autologin=True,
        # Set verify=False for self-signed certificates in development, but not recommended for production
        # verify=False # Example: os.environ.get('SPLUNK_SSL_VERIFY', 'true').lower() == 'true'
    )

    # Print connected user and Splunk version
    print(f"Connected as: {service.username}")
    print(f"Splunk version: {service.info['version']}")

    # List available apps
    print("\nAvailable apps:")
    for app in service.apps:
        print(f"- {app.name}")

except Exception as e:
    print(f"Error connecting to Splunk: {e}")
    print("Please ensure Splunk is running and connection details (host, port, username, password) are correct.")
    print("For self-signed certificates, you might need to set verify=False (not recommended for production).")

view raw JSON →